CVE-2019-13528: Improper Authorization

A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 JACE 3e, JACE 6e, JACE 7, JACE-8000, Niagara 4.4u3 JACE 3e, JACE 6e, JACE 7, JACE-8000, and Niagara 4.7u1 JACE-8000, Edge 10...

PT-2019-13393

Name of the Vulnerable Software and Affected Versions Niagara AX version 3.8u4 Niagara version 4.4u3 Niagara version 4.7u1 Description A specific utility may allow an attacker to gain read access to privileged files. This issue affects various JACE and Edge devices. Recommendations For Niagara AX...

floragunn Search Guard Authorization Issues Vulnerability

floragunn Search Guard is a German floragunn company for Elasticsearch and ELK open source plug-ins , it mainly provides encryption , authentication , authorization management and log auditing and other functions . An authorization issue vulnerability exists in versions prior to floragunn Search...

jenkins-plugin-workflow-cps-global-lib: Missing permission check in Pipeline: Shared Groovy Libraries Plugin

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries...

PT-2019-12336

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 5.1.0 Description The issue concerns unauthenticated and unauthorized access to the "default" bucket in Couchbase Server. Prior to version 5.0, the "default" bucket allowed read and write access without...

jenkins-plugin-workflow-cps-global-lib: Missing permission check in Pipeline: Shared Groovy Libraries Plugin

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries...

Debian DLA-1907-1 : libav security update

Several security issues have been corrected in multiple demuxers and decoders of the libav multimedia library. CVE-2017-9987 In Libav, there was a heap-based buffer overflow in the function hpelmotion in mpegvideomotion.c. A crafted input could have lead to a remote denial of service attack...

OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381)

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multip...

PT-2019-3167

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense Software affected versions not specified Description The issue is related to insufficient application identification in the application policy configuration, which could allow a remote attacker to gain unauthoriz...

CVE-2019-1948: Improper Certificate Validation

A vulnerability in Cisco Webex Meetings Mobile iOS could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by using an invalid Secure Sockets Layer SSL certificate. The vulnerability is due to insufficient SSL certificate validation by the affected...

PT-2019-3165

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings Mobile iOS affected versions not specified Description The issue is caused by insufficient Secure Sockets Layer SSL certificate validation, allowing an unauthenticated, remote attacker to gain unauthorized read access to...

mysql: Server: Compiling unspecified vulnerability (CPU Jul 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server : Compiling. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple...

DejaBlue, RDP Heap Overflow

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability is pre-authentication and requires no user interaction...

CVE-2019-13415

Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...

CVE-2019-13415

Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...

PT-2019-13327

Name of the Vulnerable Software and Affected Versions Search Guard versions prior to 24.3 Description The issue occurs when Cross Cluster Search CCS is enabled, allowing authenticated users to gain read access to data they are not authorized to see. Recommendations For versions prior to 24.3,...

CVE-2019-13415: Improper Handling of Insufficient Permissions or Privileges

Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...

NewStart CGSL MAIN 4.05 : java-1.7.0-openjdk Vulnerability (NS-SA-2019-0148)

The remote NewStart CGSL host, running version MAIN 4.05, has java-1.7.0-openjdk packages installed that are affected by a vulnerability: - Vulnerability in the Java SE component of Oracle Java SE subcomponent: Libraries. Supported versions that are affected are Java SE: 7u201, 8u192 and 11.0.1;...

PT-2022-5171 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 5.7.39 and prior MySQL Server versions 8.0.16 and prior Description: The issue exists due to insufficient input validation in the MySQL Server component, specifically in the Security: Privileges subcomponent. This allows...

CVE-2019-10386

A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescriptordoTestConnection allows users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturi...